Description (CNA)
While editing pages managed by MegaBIP a user with high privileges is prompted to give a reasoning for performing this action. Input provided by the the user is not sanitized, leading to SQL Injection vulnerability. Version 5.20 of MegaBIP fixes this issue.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Jan Syski / MegaBIP | affected 0 through 5.19 |
CWE
CWE-89
References
- https://cert.pl/en/posts/2025/05/CVE-2025-3893
- https://megabip.pl/index.php?id=24,145
- https://www.gov.pl/web/cyfryzacja/rekomendacja-pelnomocnika-rzadu-ds-cyberbezpieczenstwa-dotyczaca-biuletynow-informacji-publicznej
ADP enrichment
No English description supplied.
No references supplied.